By Akash Sengar · · 2 min read
Why it matters
Without enforcement, anyone can send email that claims to come from your domain. That enables phishing and business email compromise against your customers and staff. Gmail and Yahoo (since February 2024) and Microsoft Outlook.com (since May 2025) require DMARC from bulk senders, so it also affects whether your mail is delivered.
SPF, DKIM and alignment
- SPF lists the servers allowed to send for your domain. Keep exactly one record and no more than 10 DNS lookups.
- DKIM signs each message; receivers check the signature against a public key in your DNS.
- DMARC passes when SPF or DKIM passes and the domain it checked matches (aligns with) the domain in the visible From address.
The rollout path
- Publish
v=DMARC1; p=none; rua=mailto:…to start receiving aggregate reports. Nothing is blocked yet. - Read the reports for a few weeks of normal business, including month-end and any campaigns.
- Fix every legitimate sender until it passes with alignment (usually by enabling DKIM in that service).
- Move to p=quarantine. The current DMARC standard (RFC 9989, May 2026) dropped the old pct= tag; for a trial run, add t=y, which asks receivers to apply one step below your stated policy.
- When reports show only spoofed or unknown mail failing, move to p=reject.
Finding every sender
Aggregate reports show which IP addresses send as your domain and whether they pass. Typical senders beyond your mailbox provider: CRM and marketing tools, helpdesk, billing and invoicing systems, HR and payroll platforms, website contact forms and scanners or printers that email documents. Each needs DKIM signing with your domain, or an SPF include with an aligned return path.
Common pitfalls
- Two SPF records, or one that goes over 10 lookups: SPF fails for everyone.
- Staying at p=none for years. It gives reports but no protection.
- Forgetting subdomains. Use sp= to set their policy.
- No rua address, so you can't see what would break before you tighten.
After p=reject
Keep reading reports: new tools get added and keys rotate. Consider MTA-STS and TLS reporting for encrypted delivery, and BIMI if you want your logo shown in supporting inboxes.
